(in)Secure code, Exploits and mitigation AngularJS and MongoDB
26
(in)Secure code, Exploits and mitigation AngularJS and MongoDB Israel Chorzevski Tech leader, AppSec Labs
Transcript of (in)Secure code, Exploits and mitigation AngularJS and MongoDB
(in)Secure code, Exploits and mitigationAngularJS and MongoDB
Israel ChorzevskiTech leader, AppSec Labs
Agenda
Mongo query manipulation (or SQL Injection)
Angular sanitation (or HTML injection)
Angular expression injection
Live simulations and exploits for everything…
Who am I
Israel Chorzevski, over 8 years in the security research
Tech leader at AppSec Labs, Application security experts
AppSec Labs services
• Training (secure coding, hacking)
• Consulting (SDLC)
• Penetration testing
• Mobile (Android, iOS, Windows)
AppSec LabsLearning Management System
AppSec LabsThe leading Application Security Company
A bunch of Application Security Experts Ninja Pentesters of Web & Mobile Apps
Elite Trainers for Hacking & Secure coding courses
Mongo DB
No SQL – Mongo DB
Document-oriented database
You have no rows, you have a collection of objects (AKA documents)
Each document may have a different structure
Queries are written in BSON (binary JSON)
Simulation – The structure of the DB
No SQL – Mongo DB
Basic query structure
No SQL – Mongo DB
No SQL – Mongo DB
No SQL – Mongo DB
JSON.parse
Simulations
Manipulation
Denial of Service using $in
Change $inc to $set
No SQL – Mongo DB
And what happens if you have no JSON.parse?
Server code:
app.all('/login', function(req, res){
users.find( { user: req.body.u, pass: req.body.p }, function(err, user){
console.log (“successfully login”);
});
});
Simulation: node parameter_pollution.js
No SQL – Mongo DB
HTTP Parameter Pollution
What returns req.param(‘fieldX’) if the URL ends with: ?fieldX=abc&fieldX=def
[‘abc’, ‘def’]
And what will it return if the URL ends with: ?fieldX[abc]=def
{abc: def}
No SQL – Mongo DB
Bypass login simulation
Original query:
users.find({user:req.body.u, pass:req.body.p},
Malicious bypass
<input name=“p[$ne]” value=“anything” />
Final query:
users.find({user:req.body.u, pass:{$ne: 1337}},
No SQL – Mongo DB
Mitigations:
Use libraries that support parameterized queries
Perform strong input validation using:Type validation (string is a string and not an object)
Regular expression (white list approach)
Angular
Angular
Angular
Controller, Expression and Binding
ng-controller
Set the controller ($scope)
ng-bind and {{expression}}
There are two ways to show a variable content (or function’s result) into the
page
Example: <span>{{variable}}</span> <span ng-bind=“variable”></span>
ng-model
Binds an element to a variable. two-way data binding ($scope --> view and
view --> $scope),
Example: <input type=“text” ng-model=“variable” />
Binding
Simulation
http://victim-site.com:2000/angular/my_details/
ng-bind and {{expression}}
Two ways to show a variable content (or function’s result) into the page
Example: <span>{{variable}}</span> <span ng-
bind=“variable”></span>
ng-model
Binds an element to a variable. two-way data binding ($scope --> view
and view --> $scope),
Example: <input type=“text” ng-model=“variable” />
ng-bind – Encode the HTML
ng-bind-html – Allow filtered HTML
linky – Encode the HTML, change links to be clickable
http://victim-site.com:2000/angular/xss_filters2/
Direct content updating is still vulnerable !
Angular Filters
ng-bind-html – Allow filtered HTML
ng-bind-html is also not safe
Text injection
Paint big pictures
Track users using external picturesReferrer leakage
Angular Filters
Inject models:{{scared_message | filter}}
Inject scripts:{{myAlert()}}
http://victim-site.com:2000/angular/xss/new_vectors2.php
Angular – New Injections
New technologiesIntroduce new vulnerabilitiesMay reintroduce old vulnerabilities
Strong input validation can assist and is always recommended
Learn, learn, learn…
Conclusions
